Microsoft Entra's Hard Deletion Protection is in preview, and security teams are already fielding questions. Most inquiries come from information security officers responsible for identity controls and explaining them to auditors. Here are the six most common questions, with direct answers and relevant framework details for when assessors start probing.
Q1: Does this stop someone from deleting a critical app or group?
No, this is a common misconception. Hard Deletion Protection doesn't prevent initial deletion. The object still becomes inactive, and anything depending on it can break immediately. The feature blocks permanent removal during the first seven days after soft deletion. After day seven, permanent deletion is allowed.
Consider it a recovery control, not a prevention control. In ISO/IEC 27001:2022 terms, it supports resilience and recoverability, not access restriction. If your risk treatment documents describe it as a Preventive Control, update them before an assessor does.
Q2: Entra already keeps soft-deleted objects for 30 days. What does this add?
Soft-deleted objects are generally retained for 30 days, allowing administrators to restore them within that period. However, permanent deletion can end the recovery opportunity sooner. Someone with sufficient rights can hard delete an object on day one, bypassing the rest of the retention period.
Hard Deletion Protection closes that gap for seven days. While shorter than the 30-day retention, it covers the period when accidental deletions are usually noticed and when a malicious actor is most likely to try to cover their tracks.
Q3: Can't we just rely on Entra Backup and Recovery for the stuff that gets hard deleted?
No. Microsoft Entra Backup and Recovery can't restore hard-deleted objects. They must be recreated and reconfigured, which means new identifiers and access relationships may need to be rebuilt manually.
This is important for your backup and recovery evidence. If your documentation claims directory objects are covered by backup, an assessor may ask what happens after a permanent delete. Your answer should be clear: Hard Deletion Protection covers the first seven days, and beyond that, you're rebuilding. This ties into the backup requirement in ISO/IEC 27001:2022 Annex A control 8.13 and the availability criteria in the SOC 2 Trust Services Criteria. Be honest in the control description about the limits of what's recoverable.
Q4: What objects does it cover, and what does it cost?
Currently, it supports users not synchronized from on-premises systems, cloud-only groups, applications, and service principals. Entra Agent ID objects are covered through their underlying identity types. No additional license is required for the supported types.
Note what's absent: synchronized users. If a hybrid identity is deleted at the source and the deletion syncs, this feature doesn't apply to that user. Map your identity inventory against the supported types so you know where the gaps are.
Q5: Who can turn it on, and can we undo it if we pick the wrong objects?
Configuration requires the Microsoft Entra Backup Administrator role. In the Entra Admin center, go to Backup and recovery, choose Hard deletion protection, and select Add protection. Each operation covers up to 20 objects of one supported type.
Once enabled, protection can't be disabled. If you protect something by mistake and later need it permanently gone, you must soft delete it first and then wait out the seven-day window. Restoring an object keeps its protection, and deleting it again starts a fresh seven days.
To avoid mistakes, build a short approval step into your process. Record who selected the objects, why, and who reviewed the list. This supports your Organizational Controls around change management (ISO/IEC 27001:2022 Annex A 8.32) and the SOC 2 change management criteria (CC8.1). It also aligns with your Segregation of Duties Policy, ensuring the person choosing the objects isn't the only one validating the selection.
Q6: How do we monitor this, and what will an auditor want to see?
Enabling the feature is recorded in Entra audit logs. Microsoft recommends tracking deletion events there and exporting them to a security information and event management platform such as Microsoft Sentinel. You can also use Entra Conditional Access protected actions to add requirements around sensitive permissions, including permanent deletion of directory objects.
For audit evidence, think in three layers:
- Configuration evidence. Audit log entries showing when protection was enabled, by whom, and for which objects.
- Detection evidence. Alert rules in your SIEM that trigger on deletion events, plus samples showing someone triaged a real or test alert. This maps to Annex A 8.15 (logging) and 8.16 (monitoring activities), and to SOC 2 CC7.2.
- Response evidence. A documented procedure for the seven-day window. Who gets notified, who has authority to restore, and how fast. A seven-day window is only useful if someone is watching on day two.
A common failure is turning the feature on, exporting logs, and never testing the alert path. Run a controlled deletion of a non-production object and keep the ticket.
Next Steps
Start with Microsoft's documentation for the current preview scope, as supported object types and behavior may change before general availability. Check your control library: logging and monitoring, backup, change management, and privileged access. Each probably needs an update to reflect this feature, including its limitations. For structuring monitoring metrics, ISO/IEC 27004 is useful for Performance Evaluation of your detection and recovery controls. If your auditor asks how a preview feature fits your control environment, explain that you've documented its limits and are actively monitoring around it.
